stage 1 – intake, more open access, collects data over https, encrypts into postgres, then transferred to stage 2 – only current data and only certain fields kept post transfer to stage 2

So if comprised, limited data exposed.

stage 2 – not encrypted, limited access

So quarantine and encryption doing the protection.

stage 2 could be encrypted, but then for client use all data would need to go to client and sorting / filtering happens in client. seems just as secure overall to just limit access in stage 2.

How to manage transfer process? Add a succession number to track which items have been transferred. do transfers on cron schedule, or everytime new data comes in to stage 1. need a policy for expiration at stage 1.

Submitted to the Department of Electrical Engineering and Computer Science on April 24, 2013, in partial fulfillment of the
requirements for the degree of
Master of Science in Computer Science and Engineering

Abstract

This thesis presents an approach for designing secure web applications that use client-side encryption to keep user data private in the face of arbitrary web server compromises, as well as a set of tools, called CryptFrame, that makes it easier to build such applications. Crypt- Frame allows developers to encrypt and decrypt confidential data in the user’s browser. To ensure an adversary cannot gain access to the decryption keys or plaintext data, CryptFrame provides a browser extension that stores the keys and allows only sensitive regions in the web page to access them. CryptFrame performs templatized verification of sensitive regions to grant small amounts of trusted client-side code access to plaintext data in the browser. Finally, CryptFrame provides a principalgraph to help users safely change permissions on shared data in the presence of active adversaries. We use CryptFrameto modify several existing Django-based applications, requiring few source code modifications and incurring moderate performance overhead.

Thesis Supervisor: Nickolai Zeldovich Title: Associate Professor

Share this:

Like this:

Drupal Webforms (https://drupal.org/project/webform) lets power users create their own forms through a web interface, choosing the types, labels, number, etc. of fields they want. It then can present the form to final end users to fill out, and collects the data in the database. Admins can then view the results tabularized online or download as CSV.

I want to see the same available for a Angular / Django stack.

Already someone has form generation from simple json descriptions – this being a tool to make form code faster to write for developers:

Either of these would be excellent open source projects to contribute to if any student devs are looking for cool stuff to do in their free time.

Drupal Webform has one maybe “fault” – it saves results from one form submission all together in the database as one results field – as a long string of concatenated key/value pairs. Probably this is ok, maybe even best approach – you could still make the admin table of results sortable and filterable by just doing that fully on the client side.

So to get to Webforms, above needs to extended – add autogeneration to include code to send json of results to django database via restangular and django rest frameworks api/deserializer and then front end admin interface so that admins can have a tabular view of all submissions and then an option to download those submissions as CSV. So for the admin view you would just throw them into an ng-grid (http://angular-ui.github.io/ng-grid/) or better yet it would be nice to try ng-table http://bazalt-cms.com/ng-table/ which has download as CSV already built in.